Darknet Markets: Why DeFi Is the New Money Laundering Tool

As cyber threat intelligence professionals monitor these markets, they gain insights into emerging threats and malicious activities that can impact organizations and individuals. Kerberos Market is commonly cited by law‑enforcement and OSINT trackers as a newer, general‑purpose marketplace. Europol’s 2024 IOCTA notes Kerberos as a onion links prominent “emerging” market, launched in 2022 with a focus on end‑user experience and security, a wide product mix (from drugs to digital items and stolen data), and Bitcoin/Monero support. Self‑described landing pages also advertise additional coins and platform hardening features, but these claims are not independently verified.

Dark web websites: 10 Onion sites to explore

Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web. It is considered very secure thanks to strict user validations and transparent payment and vendor review procedures. Russian Market has consistently remained one of the most popular and valuable data stores on the dark web. The platform’s activity has increased significantly over the past year, indicating its growing influence and market share in the underground economy. Due to its extensive inventory and reputation for reliability, Brian’s Club has maintained a significant presence on the dark web. Quality and validity of the data it provides justify its higher cost over other marketplaces.

The Role of Cryptocurrencies

The report also revealed that despite a likely record year for overall crypto crime revenue, inflows to darknet markets and fraud shops declined in 2024. Total darknet market revenue fell from $2.3 billion in 2023 to $2 billion in 2024. Tor2door’s been a standout since 2020—over 20,000 listings and a custom-built site that’s not some cookie-cutter junk.

Exit scams

Dark web markets work much like regular e-commerce websites but with extra layers of anonymity and encryption. Buyers browse listings, place orders, and pay with cryptocurrency — typically Bitcoin or Monero — to obscure transaction trails. In this article, we’ll explore what dark web markets are, how they work, and why they’re so risky. We’ll also discuss examples of major marketplaces, myths about the dark web, and tips on staying safe in case your personal data ever ends up there. 2022 and early 2023 saw the seizure of many major darknet markets by law enforcement.

Darknet market crypto crimes on the rise in 2023, $1.7B revenue — Chainalysis

Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network). The width of the edges is proportional to the number of multihomers acting between the markets. With the advent of several markets at the beginning of 2014, the number of multisellers rapidly grows, representing more than 20% of all sellers until the beginning of 2016 (see Supplementary Information Section S3). During 2016 and 2017, AphaBay becomes the dominant market (see Fig. 3), polarizing sellers around its own ecosystem, such that the fraction of multisellers decreases to 10% of all sellers until its closure.

One Identity Unveils Major Upgrade to Identity Manager, Strengthening Enterprise Identity Security

There are some things that you can’t find on the surface internet but are available in the darknet markets. Therefore, it’s almost impossible for authorities to track those who run the darknet markets or even their locations. Emerging trends shaping darknet marketplaces in 2025—insights into cryptocurrency trading and security.

TRM Labs Highlights Surge in Vendor Shop Crypto Drug Sales

• And while the number of markets appears to be on the decline, those that remain are making more money than ever before.
• Cryptocurrencies, while offering enhanced privacy, also present significant risks.
• The dark web is a hub for cybercrime services, with a wide array of hacking tools and fraud services available for purchase.
• In total, there were 2,158 vendors who advertised at least one of the 96,672 product listings across the 30 marketplaces.
• In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home.
• The marketplace is well-known for its bug bounty programs and robust security mechanisms, including mandatory 2FA.
• Additional layers, such as two-factor authentication (2FA), encrypted PGP messaging, and built-in wallet security, significantly enhance protection against theft and hacking.
• Fifth, we consider the lifetime of each entity i at time t, defined as the time interval between the first and the last transaction performed by the entity until time t, denoted by \(\ell _i(t)\).
• Awazon Market is a top-tier dark web marketplace with claims to revolutionize secure anonymous commerce.

Our classification shows that the number of sellers is significantly smaller than the number of buyers, as shown in Figs. The number of actors in the ecosystem is affected by several factors, especially market closures. Notably, the number of buyers and sellers significantly drops after the operation Bayonet in the last quarter of 2017, which shut down AlphaBay and Hansa markets, causing a major shock in the ecosystem34. However, the number of buyers rapidly recovers, which does not happen to sellers. And over the last 9 months, using a mix of publicity stunts and crippling cyber attacks on each other, OMG, Kraken and around 10 other darknet markets have been engaged in a tit-for-tat turf war for Hydra’s throne.

Darknet Market Archetyp Takedown by Authorities in Joint Action ‘Operation Deep Sentinel’

After AlphaBay closed, Abacus Market took its place as the world’s largest underground darknet marketplaces. Abacus Market quickly rose to prominence by attracting former AlphaBay users and providing a comprehensive platform for a wide range of illicit activities. Activities on dark-web marketplaces are closely monitored by international law enforcement agencies. Purchasing or selling illegal goods—such as controlled substances, counterfeit documents, or stolen data—can result in significant legal penalties, including fines, criminal charges, and imprisonment. Even users who access these platforms without intent to buy illegal items risk suspicion or investigation. It offers access to hacked bank accounts, credit card data, and cryptocurrency laundering tools.

Beyond Bug Bounties: How Private Researchers Are Taking Down Ransomware Operations

But while anonymous email services can help protect your identity, they don’t make you immune to threats like email spoofing or social engineering. And it’s still essential to use strong passwords and two-factor authentication (2FA) to help keep your account secure. ProPublica is one of the safer Tor sites to visit, because it doesn’t link to illegal content or activities. Instead, it focuses on publishing stories and holding powerful institutions accountable. Other major news sources blocked in some countries, like the BBC, also have dark web versions.

Best Remote Administration Tools (RAT Tools) – 2026

In many cases, fear of arrest prompts administrators to run exit scams before enforcement action becomes public. Constant uncertainty, fear of scams, and enforcement pressure create sustained stress. Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier. The same reports highlight gaps in the national ability to measure the full scale of this activity. Journalists use the dark web to communicate with sources anonymously, and whistleblowers rely on it to share sensitive information without fear of retaliation.

• Changes in site availability, communication channels, or technical setup are closely monitored.
• Longevity, code reuse and past exit-scam history are factored in, but we weigh present behaviour more heavily.
• According to Chainalysis, the total number of active markets in November 2020 (37) is the lowest total seen since November 2017.
• Users favor marketplaces with straightforward navigation, efficient search functions, and clear product categorizations.
• In March 2015, the marketplace fell victim to an exit scam, with its administrators absconding with approximately $12 million in bitcoins.
• Understanding both the lawful and unlawful scenarios helps provide a balanced view of their practical applications in 2025.
• That way, they aim to create secure forums and limit outsiders like law enforcement.

Print & Digital

These arrangements help maintain an accessible platform and do not result in additional costs to readers. Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space. “Good digital hygiene, especially in terms of password and seed phrase management, is also crucial,” he said. In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content.

Dutch National Police share depth and sophistication of Genesis Market identity theft operation

Users and cybersecurity professionals alike must stay informed and prepared to navigate this rapidly changing digital frontier. Understanding both the lawful and unlawful scenarios helps provide a balanced view of their practical applications in 2025. Treat category rosters and counts from tracker pages as indicative, not definitive.

Torrez Market

I’ve used it a handful of times; deliveries landed smooth via DeadDrops—plain packaging, no fuss. It’s not the biggest player like Abacus, but it’s got a loyal crew and uptime that rarely blinks. If you’re into a darknet market that feels cutting-edge and keeps your coins safe, ASAP Darknet Market’s a gem—just don’t expect a massive catalog yet; it’s more about precision than sprawl. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period.

The 17 Best Dark Web Marketplaces in 2026

Tor Browser provides anonymity by routing your traffic through a global volunteer network. Ethically, they must minimize harm, responsibly handle any stolen or sensitive data (often notifying victims or law enforcement), avoid entrapment, and maintain research integrity. An award-winning cybercrime threat intelligence firm, KELA’s mission is to provide 100% real, actionable intelligence on threats emerging from the cybercrime underground, to support the prevention of digital crimes. As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure. And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences.

• Therefore, key actors in the ecosystem of DWMs may play important roles in broader criminal networks.
• In a DDoS attack, the server is bombarded with artificial traffic, which makes it difficult for the server to process web requests, and it ultimately goes down.
• The report reveals that 2023 also saw a rise in the prominence of approval phishing scams.
• The broad category mix positions Vortex as an entry-level market for general illicit trade.
• These types of scams more than doubled in revenue year-over-year, with data indicating a growth of 85x since 2020.
• Cryptocurrencies like Bitcoin and Monero facilitate darknet transactions by offering anonymity, with Monero being particularly favored for its superior privacy capabilities.
• Additionally, we analyse the U2U network of transactions, i.e., the transactions between pairs of market first-neighbors where the source and destination nodes are market users without the market as an intermediate.

What Is Predictive Threat Intelligence? How AI Helps Anticipate Cyber Threats

Services for breaching personal accounts and systems are also commonly advertised, reflecting the evolving landscape of hacking tools and fraud services on the darknet. The availability of such services underscores the ongoing threat posed by cybercriminals operating on these platforms. The market’s diverse product range and secure transaction methods have made it a prominent player in the darknet market ecosystem. As we move through 2025, WeTheNorth continues to be a crucial platform for dark web users. Cypher Marketplace’s extensive product listings and secure transaction methods have made it a popular destination for dark web users. Its continued growth and prominence in the darknet market ecosystem highlight its importance in 2025.

• Ransomware groups are anticipated to split into smaller, independent units, making them harder to track.
• Infostealers and drainers will likely be increasingly promoted as subscription-based services, with traffers aiding in their distribution via scam pages and phishing schemes.
• These systems often resemble eBay-like formats, allowing buyers to compare products and vendors based on reviews and ratings.
• To expand their reach, some marketplaces established parallel channels on Telegram.
• It hosts an onion site so people in countries with restricted press freedom can access its journalism, which covers everything from hacktivism to government repression.
• It has built a reputation for being a reliable source of stolen credit card data and PII.
• The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively.

Torch is one of the more established dark web search engines, designed to help users navigate the Tor network and discover onion sites. Unlike traditional search engines like Google or DuckDuckGo, Torch indexes hidden websites that operate beyond the reach of the surface web. But users should always be cautious and avoid clicking unfamiliar or untrusted links to steer clear of scams or malware. At KELA, we help you identify and mitigate risks by providing actionable intelligence from the darknet. Our solutions empower you to monitor illicit darknet marketplaces and track emerging threats, ensuring you can take proactive measures to protect your organization and reputation.